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^ ! Abstract 

We develop the concept of quantum carrier and show that messages can be uploaded and down- 
rG ' loaded from this carrier and while in transit, these messages are hidden from external agents. We 

C*h| explain in detail the working of the quantum carrier for different communication tasks, including 

quantum key distribution, classical secret and quantum state sharing among a set of n players ac- 
C ' cording to general threshold schemes. The security of the protocol is discussed and it is shown that 

only the legitimate subsets can retrieve the secret messages, the collaboration of all the parties is 
needed for the continuous running of the protocol and maintaining the carrier. 
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j^ : 1 Introduction 

O 

(<— ^ ' Entanglement has been used in many different protocols of quantum information theory, from tele- 

portation and key distribution to secret sharing |[Tl|2l[3]|4l|5]|6]|2l[ll IH [lOl. In all these protocols, 
entanglement is a resource which is completely consumed by measurements of the parties involved 
and should be generated anew for next rounds of protocol. It is true that generating and maintain- 

/\ ' ing entanglement between several particles is very difficult. Yet with the developments in realizing 

quantum repeaters ifTTlfTSlfTSl , creating and maintaining long distance entanglement between station- 
ary quantum systems becomes more feasible in the (possibly distant) future. It is thus rewarding to 
imagine if this entanglement can used in a different way, that is as a carrier of information, which 
modulates and transmits quantum information, in the same way as carrier waves in classical commu- 
nication systems carry modulated messages. In this new application, we can imagine that arbitrary 
quantum states are uploaded (entangled) to the carrier by the sender and downloaded (disentangled) 
from the carrier by the receiver(s), in such a way that at the end of the protocol, the carrier remains 
intact and ready for use in next rounds. The role of the quantum carrier and its entanglement with the 
messages will be to hide messages from adversaries, hence the term secure quantum carrier 



'email: vahid@sharif.edu, coiTesponding author 
-email:milad.marvian@ee. sharif.edu 



This new way for using entanglement was first reported in lfT4l for quantum key distribution and 
then was developed for a simple secret sharing scheme in JS) . In this paper we want to develop it fur- 
ther and provide quantum carriers for secret sharing schemes for general threshold schemes lfT5l[T6l . 
Needless to say, our aim is not to develop new quantum secret sharing schemes, but to develop a quan- 
tum carrier for distributing in a secure way the already known quantum secrets among the parties. Our 
emphasis is thus on the very concept of secure quantum carrier and the way it can be used in quantum 
communication protocols. In the particular context of quantum secret sharing, as we will see it allows 
us to generate broader threshold schemes than those of ifTTlfTsl . 

In particular we have to stress the difference with the works in ifTTl [TSl where it was shown that 
graph state formalism |[T9l can act as a framework for unifying some of the secret sharing protocols, 
albeit not for general threshold structures. The idea of iflTlfTsl was to encode the secret in some local 
actions of the dealer on a vertex of a suitably chosen weighted graph state. Local measurements of 
the players on different vertices of this graph, could then reveal the secret to authorized subsets of 
players. In this way, it was shown that threshold schemes of the type (n, n), (2, 3) and (3, 5) can be 
implemented in a unified way for various forms of channels interconnecting the dealer and the play- 
ers. Therefore the works of ifTTllTSl belong to the same class as in ([ij, in which entanglement is fully 
consumed due to measurements of the players. 

It is to be noted that while the idea of a fixed quantum carrier has an appeal for communication, 
a price should be paid for its implementation: it requires a larger number of particles to be entangled 
at the beginning and end of the protocol, but at the end of each round a fixed amount of entanglement 
remains in the form of a carrier. Nevertheless, it is worth to develop such a concept from theoretical 
side and hope that it will someday become close to reality. 

We remark that although we present our analysis for secure communication of basis states or clas- 
sical information, the idea also works for sending arbitrary quantum states. In the simplest protocol 
discussed in the beginning of the paper we explicitly show this, although we will not repeat it for other 
general schemes. 

The structure of this paper is as follows. In section|2]we put forward the basic requirements that 
a quantum carrier should satisfy, in section [3] we explain the basic method in the simplest possible 
setting, that is quantum key distribution between two parties. Then in section |4] we briefly explain 
the use of quantum carrier for the simplest secret sharing scheme, where one dealer, wants to share a 
secret between two different players who have equal right for retrieving the message collaboratively. 
For this reason, this is called a (2,2) secret shring scheme. This is then generalized to the {n,n) 
scheme where a secret is to be shared between n players and all the n players can retrieve the message 
collaboratively. Finally in section|6]we define the carrier for the (fc, n) threshold scheme where any 
of the k players can retrieve the secret, although collaboration of all of the players is needed for the 
continuous running and security of the protocol. We end the paper with conclusion and outlook. 

2 General Considerations On the Quantum Carrier 

Suppose that a quantum carrier has been set up for a specific communication task, i.e. for a quantum 
key distribution between Alice and Bob or a secret sharing scheme, between Alice as the dealer and 
Bob and Charlie as the players. This quantum carrier should have the following properties: 

• There should be simple and local uploading and downloading operators, so that the legitimate 
parties can upload and download messages to or from this carrier. 



• While in transit, the messages should be hidden from third parties so that no intercept-resend 
strategy can reveal the identity of the message. 

• Eve should not be able to entangle herself to the quantum carrier without being detected by the 
legitimate parties. This property is to prevent Eve from conducting more complex attacks. 

Once such criteria are met, we say that a secure quantum carrier has been set up for this commu- 
nication task. In the rest of this paper we present quantum carriers for various communication tasks. 
We should stress again that these requirements are purely from the theoretical point of view, the main 
difficulty will obviously be to maintain the carrier for a long enough time so that it can be used for 
passing many quantum states before the entanglement decays and becomes useless. 

3 Quantum Carrier For Key Distribution 

The first task that we discuss is the simple communication between two parties, where Alice wants to 
send a sequence of bits and 1, a classical message, to Bob lfT4l . Alice encodes the classical bits 
and 1 into states |0) and |1) (the eigenbases of the Z operator). The quantum carrier is 
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)a.6:=— (|0,0) + |1,1)K,„ (1) 



where a and h refer to the Hilbert spaces of Alice and Bob respectively. The Hilbert space of the 
message is denoted by a number 1 (since one qubit is being transmitted). The uploading operator, 
used by Alice, is a CNOT operator which we denote by Ca,i, 

CaA\i-,3)a,\ = |i,i+ j)a,l- (2) 

The downloading operator is Ch,\, i.e. with control port by Bob and target port the message. 

Consider now a classical bit s which is encoded to the quantum state \s) and is to be transferred 
from Alice to Bob. Alice performs the local operation Ca.i on the state \(\>)a,h\s)i, turning this state 
into 

l<^.)aAl = -7|(|0>0,s) + |l,l,s'))aAl, (3) 

where s' := s + 1 mod 2. While in transit the message is in the state 

Pi = ^(N>(^l + k'>(^'l) = ^/, (4) 

and hence inaccessible to Eve. At the destination. Bob can download the message from the carrier by 
his local operation C(,.i, which disentangles the message and leaves the carrier in its original form, 
ready for use in the next round. The fact that Bob downloads exactly the same state which has been 
uploaded by Alice is due to the perfect correlation of the states of Alice and Bob in the carrier Alice 
can also use this carrier for sending quantum states to Bob. Linearity of the uploading and download- 
ing operations allows Alice and Bob to entangle and disentangle a quantum state |0) = a|0) + 6|1) to 
and from the carrier 

To conduct a somewhat complex attacks on the communication. Eve can entangle herself to the 
carrier and try to intercept-recend the message. To do this the only possibility for her entanglement is 

l0')aAe=|O,O)|eo> + |l,l)|Cl), (5) 



where |^o) and |^i) are two un-normalized states of Eve's ancilla. Any other form of entanglement, 
i.e. one in which a term like |0, 1) I77) is also present in the above expansion, will destroy the perfect 
correlation between the sequence of bits transmitted between AUce and Bob. In case that the two 
parties are using the carrier for sending classical bits, Alice and Bob can publicly compare a subse- 
quence of bits to detect the presence of Eve's entanglement. In case that they are using the carrier for 
sending quantum states, Alice can insert a random subsequence of basis states into the main stream 
of states and ask Bob to publicly announce his results of measurements of these specific states. This 
strategy also works in other more complicated schemes presented later, namely the (n, n) and the 
{k, n) schemes. 

In order to prevent this type of entanglement, we now use a property of the carrier ([T]) which turns 
out to be important in all the other forms of quantum carriers that we will introduce later on. This is 
the invariance property of the carrier ([T|) under Hadamard operations, that is 

{H®Hm^\<f). (6) 

At the end of each round, when the message is downloaded and the carrier is clean, both Alice and 
Bob act on their share of the carrier by Hadamard operations. In the absence of Eve, the carrier will 
remain the same, however in presence of Eve, (who supposedly acts on her ancilla by a unitary U) the 
contaminated (entangled with the ancialla of Eve) carrier ([T]) will turn out to be 

{H®H®U)\4>')a.b,e = ! + ,+)!%) + |-,-)k/l) 

= ^(|0,0) + |l,l))(ho> + |m)) 

+ i(|0,l) + |l,0))(ho)-|m)), (7) 

where jryo) = ^l^o) and |?/i) ~ C/|^i). The second term in the carrier will certainly introduce anti- 
correlations into the basis states communicated between Alice and Bob, unless |?7o) — |?7i) and hence 
1^0) = \£,i) which means that Eve cannot entangle herself to the carrier. 

4 Quantum Carrier For (2,2) Secret Sharing 

In this scheme, Alice wants to share a secret with Bob and Charlie so that they can retrieve the message 
only by their collaboration. The first quantum protocol for this scheme was designed in |[T1 where it 
was shown that measurements of a GHZ state in random bases by the three parties can enable them 
to share a random secret key. The secure carrier for this protocol was first developed in |8J. Its 
characteristic feature is that two types of carriers, should be used which are turned into each other by 
the Hadamard operations. The two carriers are 



yodd/ 



-^(|000> + |111)), (8) 



used in the odd rounds 1, 3, 5, • • • and 



|0cvcn> := ^(|000) + |011) + |101) + |110)), (9) 

used in the even rounds, 2, 4, 6, • • • . The two types of carriers are turned into each other by the local 
Hadamard action of the players at the end of each round, 

H®^\4>om) = |0cven), ^®'|0even) = |0odd). (10) 



This property is crucial in checking the security of the protocol and detection of a Eve attempts who 
may entangle herself with the carrier and intercept the secret bits. 
In the odd and even rounds, the secret bit s is encoded differently as 

|sodd> := \s,s) 

|5-evc„) = ^(|S, 0) + \S\ 1)) = i=(|+, +) + i-ir\-, -)), (11) 

where s' = s + 1 mod 2. While in the odd rounds, the receivers each receive a copy of the sent bit, in 
the even rounds they need each other collaboration for its retrieval. Therefore Alice can use the odd 
rounds to put random stray bits and put the message bits in the even rounds. 

In our opinion this property of the protocol, that is, a rate of one-half in sending message bits is analo- 
gous to discarding one-half of the measured bits in measurement-based protocols. However the bonus 
here is that Alice can send pre-determined non-random messages. 



Note that in both even and odd rounds the carrier can be written as 

|'/')a,6,c : 



^El9)«l^)^- (12) 



q=0 

where we have dropped the subscripts even and odd to stress the uniformity. The running of the pro- 
tocol, i.e. the uploading and downloading operations, are based on the following readily verifiable 
identities which we state for odd and even rounds separately without writing the subscripts "odd" and 
"even" explicitly: 



For odd rounds: 



For even rounds: 



Ca,lCa,2\q)a\s) 1,2 = |g)a|g + s)l .2 
C6,lCc,2|5)6,c|s)l,2 = \q)b,c\q+s) 1,2- (13) 



Ca.l\q)a\s) 1,2 = \q)a\q+_s)l.2 

Cb,iCc,2\q)b,c\s)i,2 = \q)b,c\q + s)i,2. (14) 

Equations (fT2l[T3] and[T4l) show how the encoded secret can be downloaded by Alice and down- 
loaded by Bob and Charlie in different rounds. In the odd rounds, the uploading operator is simply 
Ca,iCa,2, and in the even rounds it is Ca,i- In both types of rounds the downloading operator is 
Cb,iCc,2- These string of operators, that is, uploading, carrying and downloading is depicted as fol- 
lows: 

I 1 

\(t>) a, b,c\s) 1,2 — )► upload — > —=^\q,q,q + s)a,b,c,i,2 — ^download — > \(l>) a, b,c\s 1,2) (15) 

^ q=0 

The above equation shows that any state \x) ~ J2s '^s\s) can be encoded as \x) = J2s '^s\s) and 
transferred by the same operations. So this protocol can also be used for quantum state sharing in a 
secure way. The problems of security of the carriers and the impossibility of Eve's entanglement with 
them, has been analyzed in detail in |[8|| . The main points are that i) the secret state is transferred from 
Alice to Bob and Charlie in a mixed state and hence carries no information to outsiders, and ii) the 
carriers in even and odd rounds are turned into each other by local Hadamard actions of Alice, Bob 
and Charlie, a property which is possible only in the absence of any entanglement with Eve. Any 
entanglement will have a detectable trace on a substring of transferred states, which will be used to 
detect the presence of Eve IH. 



5 Quantum carrier for {n,n) secret and state sharing 

The previous protocol can be generalized to the {n, n) scheme, where all the n players should retrieve 
the secret collaboratively. In this case the encoding of a bit s to quantum states for odd and even 
rounds is 

|5odd) = |S)«"=|S,S,...S) 
l^evcn) = -^(| + ,+,---+) + (-l)'l-,-, •••-)) (16) 

Therefore |Oovon) is an even parity state, and |lovon) is an odd parity state. 

Then the protocol runs as in the (2, 2) case with the obvious generalization of the carrier and the 
uploading and downloading operators. In fact in both types of rounds the carrier can be written as 

l'^) = 7f E l9'9)' (17) 

geZ2 

where \q) stands for the encoding in ( fTSI ) and we have suppressed the subscripts "even" and "odd" 
for simplicity. The uploading operator will be Ca '■— Ca.iCa,2 ■ ■ -Ca.n for the odd rounds and 
Ca := Ca.i for the even rounds. The downloading operator will be the same for both rounds and 
will be Cs := Chi,iCh.2,2 ■ ■ ■Ch„,n- 

To show that the protocol runs in exactly the same way as in the (2,2) scheme, we need to prove 
the basic properties of the encoded states and the carrier. To this end, we first note from ( fT6b that the 
following relations hold, 

1 ^ 1 ^ 

iJ®"|Sodd) = -= ^(-l)^^|Xevc„), i?®"|Scven) = "= ^ (- 1)^^ |Xodd) ■ (18) 

V 2 ^=0 V 2 ^^Q 

From these two relations one easily shows that the carriers in the even and odd rounds are turned 
into each other by the local Hadamard actions of players. Second we need the generalization of the 
properties (fT3]and[T4l) to the (n,n) case. To this end we start from the simple properties 

CaAq)a\+)l = \q)a\+)l C,,: |g)a | -) i = (-1)^ |g)a | -) 1 , (19) 

to obtain 

Ca,lk>a|Scvcn)l,..„ = "^ {CaAq)a{\ + , +,•••+>+ (-l)'h, ", ))l....rO 

= -L(|q)J| + ,+,...+) + (-ir+'^|-, -,...-))!,...„) 

= l9)a|(g + sUn)l,...„. (20) 

The only other non-trivial relation which we should prove is the following relation for the even rounds 
which is necessary for the downloading operation, (for the odd rounds, the involved states are product 
states and the relation is obvious): 

C6i.iC6,,2---a„,„|g)|s) (21) 

To show the validity of this relation we first use the following simple property of CNOT operation, 
where the first bit is the control and the second bit is the target qubits; 

C| + ,+) = !+,+>, C| + ,-) = |-,-), C|-,+) = |-,+), C|-,-> = ! + ,->. (22) 



Second we use these properties and ( fTSI l and the abbreviation Cb '■= Cbi.iCb2 ,2 • • • Cb^, ,n to obtain 

CB\qm = icB(i+)^" + (-in-)®")(i+>®" + (-i)i-)®") 

= ^(|+)®" + (-l)'|->®")(|+)®" + (-i)^+1->^") = l9)|gT^). (23) 

This completes the description and validity of the uploading and downloading procedures for the (n,n) 
scheme. 

In passing we note that the form of the carrier ( fTTl ) for this {n, n) secret sharing scheme is the 
same as in the simplest cryptographic protocol,©- We will see in the next section that the appropriate 
carrier for the threshold scheme (fc, n) where n is an odd prime, is of the same form. We will explain 
the reason for this general structure in the last section, however before that, we explain in detail the 
carrier for the (fc, n) secret sharing scheme. 

6 Quantum Carrier For (/c, n) Threshold Secret Sharing 

There are situations where there are n players and any subset of k or more members can retrieve the 
secret, while subsets of smaller size cannot. This is called a (fc, n) threshold structure ||20l 1211 in 
which all the players have equal weight. One can also imagine situations where different players have 
different weights. This leads to a general access structure, according to which the players form a set 
TZ of say n members and an access structure is a collection A of subsets of TZ. The subsets in A (and 
their unions) are called authorized subsets and the members of each authorized subset should be able 
to retrieve the key by their collaboration, while the subsets which are not in A, called adversaries, 
cannot retrieve the secret. It is known that once a threshold scheme is solved, then other more general 
access structures will be possible 1221 1231 . For example if 7?. = {a, &, c} and A = {{a, 6}, {a, c}} , 
then we can run a (3, 4) threshold scheme giving 2 shares to a and one shares to b and c each. 

The (fc, n) threshold scheme was first generalized to the quantum domain in |T5^|, where quantum 
states could also be shared between n parties so that any k of the players could retrieve the quantum 
state collaboratively. To be in conformity with the no-cloning theorem, n had to be smaller than 
2k. We will deal in detail with the case where n = 2fc — 1 is a prime number. Other cases where 
n < 2fc — 1 are obtained by a simple modification of the (fc, 2fc — 1) scheme. For example a scheme 
like (fc, 2fc — m) is implemented by running the scheme (fc, 2fc — 1) as usual, but with Alice playing 
the role of the other m — 1 receivers in addition to her usual role. The idea of ifTSl was to adapt 
the polynomial code, first developed in E4L to the quantum domain. Note that in lITSl . quantum 
mechanics was exploited only for message splitting and not for message distribution. Later it was 
shown in ifTTl FTSl that graph states can be used for combining the two parts of the problem in one 
scheme, for some threshold schemes, namely for (2, 3), (3, 5) and (n, n) schemes. Here we show that 
the idea of quantum carrier can be used to provide a method of secure distribution for all secrets of 
the (fc, n) types provided in ||T5| . Let us first see what a polynomial code is. 

6.1 The polynomial code 

Consider a symbol s. Classically if we want to share this symbol as a secret between n parties, 
called i?i , i?2 , ■ ■ • Bn, so that any k members of the parties can retrieve this symbol and fewer than k 



members cannot, we can define a real polynomial of degree A: — 1 in the form 

Pc,s{x) ■.= Co+ClX + C2X^ -\ Ck-2X''^'^ + s x''~'^ (24) 

and evaluate this polynomial on n distinct points xq, ■ ■ ■ Xn-2, and Xn~i- We can then give the 
member Bi of the set, the value Pc.s{xi)- It is a simple fact that a polynomial of degree k — 1 
is completely determined by its values on k distinct points. So any k members can compare their 
values and determine the full functional form of the polynomial and hence the real number s. To 
make the process simple and less prone to errors, we can substitute the real number field with the field 
Zn := {0, 1, 2, • • • n— 1} (where n is prime). For the n points in Z„ we can take simply Xi — i. Hence 
we can encode the symbols into a product state I s) := \Pc.s{Q))b ®I-Pc.s(1))b, ■ ■ ■®I^c.s('^~1))b„- 
Let us now sum such a product state over all possible c G Z'^^^, and obtain the code 



Is) := -jl= J2 I^c,.(0))b^®|Pc,.(1))b, •••®|Pc,.(r^-l))B„ 

2= V |Pe„s(0),Pc,s(l),---,---Pc,.(n-l)). (25) 

IT A: 1 ' 






cez„ 



In order to see how to find a suitable carrier for this code, and indeed in order to show that the carrier 
for this code falls within the same class of carriers considered so far, we have to prove further algebraic 
properties of this code. To do this, we cast it in the form of a Calderbank-Shor-Steane (CSS) code 



6.2 The CSS structure of the polynomial code 

Let n be a prime number With addition and multiplication modulo n, the set Zn '■— {0, 1, 2 • • • n — 
1} will be a field. For any n, Z^ is a a vector space over Z„, i.e. Z^ is the set of all n-tuples 
{vi, V2,- ■ ■ Vn) where Vi G Z„. Let C be a linear code, i.e. a subspace of Z", spanned by linearly 
independent vectors {eo, ei, • • • efc_2}. Thus C is isomorphic to Z^^^. Consider the case where the 
dual code of C, i.e. the code space spanned by all the vectors which are perpendicular to C, contains 
C and has one more dimension. Let C^ be spanned by the vectors {gq, ei, • • • , ek-2} Ui^fe-i}- 
Thus we have 

C = Span{eo,ei, • • •efc_2} 
C^ = Span{eo,ei,---efc_2,efc_i}. (26) 

In the codes that we will introduce, the special vector e :— Sk-i is normalized so that e • e = — 1. We 
therefore have 

l<hJ<k-2, 

< j < fc - 2, (27) 



e; 


•ej = 


= 


e 


ej = 


= 0, 


e ■ 


e = 


-1 



We will now define the following special Chalderbank-Steane-Shor(CSS) code 11251 1261 1271 [1611 . whose 
codewords correspond to the classes of the quotient space C^ /C: 

|s):=^l=^|c + se) (28) 

V" cec 

Thus one dit s is coded into the ?i-qudit state \s) which is to be distributed between the n receivers, 
each component of the vector being given to one participant. 



In the appendix, we will show the vectors e; with components 

(e/), =/, j = 0, l,---n-l, l = 0,l,---k~l (29) 

satisfy all the properties hsted in jTU . Explicitly we have 

eo = (1, 1, 1, 1), 

ei>i = (0, 1, 2',---(n-l)'). (30) 

It is now very simple to see that the CSS code thus constructed is nothing but the polynomial code in 
To see this we note that the vector c G C has the following expansion 



fe-2 
C = 

1=0 



^ciei (31) 



and hence the components will be 

/fe-2 \ fc-2 



(c + se)j = J2 c^eOj + s(efe-i)j = (^ Qj') + sf-^ = Pc,.(j). (32) 



\l=0 / 1=0 

Therefore giving each components to one player, the code will be 

|s),,.fa,,..,„ := ^4^ V |Pe,s(0),Pc,.(l),---,Pc,s(n-l)), (33) 

which is exactly the polynomial code ( l24l i. Now that the CSS structure of the polynomial code is 
revealed, many of its properties can be proved in a simple way. In particular we need the following 
property which plays an important role in the security of the carrier. 

Leinnia:r/!e set of all (fc, n) codes A33\l . is invariant under the joint multi-local Hadamard oper- 
ation, i.e. 

_. n — l 

where u is a root of unity, cj" = 1. 

We use a well-known property of the CSS codes according to which, 

^-|W)^^E-^-n^)^ (35) 

where | Ci /C2 1 is the number of cosets Ci /C2 . To adapt this general relation to our case, we note that 
in our case \C^\ = \C-^\ — n^, |C^| = \C\ — n'"'^^, and hence |C^/C^| — n. Moreover we make the 
following substitutions, 

|w) — >\c + se) = |s), |v) — ^ |c + xe) = \x), (36) 

and note that 

(w) • (v) = (c + se) ■ (c + xe) = —sx. (37) 

Putting all this together proves the lemma. 



6.3 The carrier and the uploading and downloading operators 

The quantum carrier is constructed as follows: 

!'/')„,.,......„ -^ E l'?)J9).i,-.„- (38) 

The important property of this carrier is that it is invariant under the joint action of Hadamard opera- 
tors, performed by Alice and all the other players. Using (|34] | proves this assertion: 

ij«"+i|0) ^ i ^ w— «^|x, y) = ^Y.\x,x) = 10). (39) 

In order to see how Ahce uploads secrets onto the carrier and how the players download the secret 
from the carrier we need some algebraic properties of the code. 

Definition: For any vector v = (ui, W2, • • • w„) G Z''^ define the following string of CNOT opera- 
tors performed by Alice: 

C^(v):=QiC:VC^„. (40) 

Also define the following multi-local operator for Bob's: 

Cb '■— Ch^,lCh.2,2- ■ -Ch^^n- (41) 

Tlieorem: The operator Ca '■— Ca{g), for e as in H30\l , uploads the message into the carrier by 
Alice and the operator Cg downloads the message from the carrier by Bob's, leaving the carrier in 
its original form. 

We fist show that for any state \q)a and any message |s)i,2,-n 

CA\q)\-s)^\q)WT^. (42) 

This is seen by expansion of |s) in components and noting that 

Caw's) = —j===CA\q) V |(c + se)i, (c + se)2, • • • (c + se)„) 

cez„ ^ 

= ^^^l9> Y] |(c+(s + (z)e)i,(c + (.s + q)e)2,---(c + (s + <z)e)„) 

^ cez!;-^ 

= \q)\-^Tq). " (43) 

From ( l43T l, we see that 

CAms) = ^ E CAhq)\-s) = ^5^k,g)|?T^). (44) 

Therefore Alice uploads (entangles) the message |s) to the carrier by the local operation Ca- For the 
other part, we need the following 

CB\qm = \q)\JT^). (45) 

To show this we note that 

CB\q)\s) = CB^\c + qe)\c' + se) 
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= ^\c + qe)\c' + C+{s + q)e)^\q)\s + q). (46) 

c.c' 

From this last equation we find that 

Cb' E k' 9)1^+9) = E l9'^)l^), (47) 

which means that the players, can download the message from the carrier and put the carrier back to 
its original form. 

The basic steps of the quantum secret sharing are now clear A carrier in the form of the state \(j)) 
is shared between Alice and all the receivers, i?i, 52, • • • B„- Alice operates by his Ca operator on 
her part of the carrier and the code state \s) and thus entangles the code state to the carrier \cf>). At the 
destination the players act on the carrier and the code space by C^^ and download the state \s). From 
this code state, no less than k players can retrieve the secret symbol s. The carrier is now ready for 
transferring the next code state. 

7 The Security of the Quantum Carrier 

In this section we discuss the security of state transmission via the carrier and analyze two types of 
attacks performed by Eve. The security of the retrieval procedure of the symbol s from the encoded 
state |s) need not concern us and has been discussed elsewhere ifTSi . Obviously the analysis of security 
depends on the resources available to Eve. We consider two types of attacks in the following two 
subsections. This type of analysis applies to all the schemes mentioned up to now. 

7.1 Simple intercept of message by Eve, without her entanglement to the car- 
rier 

In this type of attack we assume that Eve is not entangled with the carrier, but she has access to all the 
message qudits sent from Alice to the players. After uploading the message, the full state is given by 

\(l>s) = ^ E l9'9,¥T^>A,B,i...„- (48) 

^ qez„ 



While in transit the data qudits are in the state 



-^Ei^)(^ 



PD = - }_^\s){s\, (49) 

sez„ 

which is an equal mixture of all the encoded states. Therefore even if Eve have access to all the data in 
transit and intercepts all the qudits sent to all the players, she cannot acquire the secret s or the secret 
state, since she only finds and equal mixture of all the encoded states. 

At the destination, the receivers, act by the inverse local operator Cb and according to (l47T l. disen- 
tangle the code from the carrier They can then retrieve the classical secret s by collaboration of each 
other according to the access structure. Once retrieved, we resort to the arguments of |[15J to show 
that this encoded state is secure against cheating of groups of unauthorized players. 

Therefore in the simplest intercept attack. Eve does not acquire any information about the secret 
symbol s. We now consider more general attacks. 
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7.2 Entanglement of Eve to the carrier and intercept-resend attack 

We now assume that in addition to access to the message channel. Eve can entangle herself to the 
carrier. Let us see if she can do appropriate action for intercepting the encoded state |s) and not an 
equal mixture. Consider the first round where the symbol si is encoded to |si) and sent by Alice. The 
state of the carrier and the message after Alice uploading operation will be 

\(f>^^Ksi))a^B,AI = —=^\q,q)a,B\l+^l)M, (50) 

where a stands for Alice, B for all the players i?i , • • • Bn and M for the n message qudits, toi , m2 , • • • 77i„ 
Eve can now set her n ancilla qudits E := (ei, e2, • • • e„) to \0)e, and then do the following oper- 
ations: acts by Cm,e := CjnueiCm2,e2 ■ ■ ■ C'm„,e„ which transforms the state |(^^^^(si))q,s,m|0)_e 
to 

\<l>'''^Hsi))a,B.M.E = -^y^ \q,q)a.B\q + Si)M\q + Si)e- (51) 

When Alice and the players execute the first round of the protocol to the end and the players extract the 
state I si). Eve acquires nothing from the symbol si, however she has achieved in entangling herself 
with the carrier in the form 

\(l}')a,B.E = -^^\q,q)a.B\q + Si)e- (52) 

In the second round, when the symbol S2 is being sent and the full state is of the form 

|0'(s2))a.B,_B,M = ^ y^ k,9)a.s|g + S2>A/k + Sl)E, (53) 

Eve performs the following sequence of operations; 1) acts by C^l^ to produce the state 

|0''-^Hs2))a,B,B.A/ = -^y^k,9>a.sk + S2}A/|si - S2)e, (54) 

2) measures the ancillas to acquire s\ — s^, and 3) acts by Cm,e to put back the full state in the form 
( l53T l. When Alice and the players finish the second round, they acquire the symbol S2, but Eve also 
acquires the symbol s\ — S2, while she is still entangled with the carrier in the form ( l52b and is ready 
to do the same attack for the next round. In this way she is able to retrieve the sequence of symbols 

s\ - S2, Si - S3, Si - S4, • • • . (55) 

This sequence enables her to find the whole message by checking n different choices for the original 
symbol si. This shows that if there is a possibility for Eve's entanglement with the carrier, she is able 
to successfully intercept all the data. 

In order to prevent this, Alice and the players act on their respective qudits of the carrier, by 
Hadamard operations. As we have seen above, this operation leaves the pure form of the carrier 
invariant. Let us see if this operation is able to detect an entanglement of Eve, i.e. a contamination 
of the carrier It is clear that if the carrier contains terms which are not of the form \q^'q)a.B, then 
there will be mismatches between what Alice uploads and what the players download. This mismatch 
can easily be detected by public announcements of some stray bits which are deliberately inserted 
into the stream of the symbols. In order to escape this detection, the only admissible form of Eve's 
entanglement with the carrier is 

!</)') = E 19' ^>®ie9>, (56) 
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where ^q are a collection of un-normalized states of Eve. The method of detection in this case is 
the same as in the simple (2, 2) case, discussed after equation (|7]i. Also in view of the discussion in 
subsection l7.3l only the legitimate parties or even a subset of them are required to publicly announce 
the results of their measurements. 

In order to prevent this type of apparently undetectable entanglement, we note that the pure carrier 
is invariant under the action of Hadamard operators, while this contaminated carrier is not. In order to 
retain the correlations. Eve may operate on her ancilla by a suitable operator U to change the above 
state into 

[H (g, iJ®" ® C/)|0') = ^ ^ c^«(^-^)|x,y) (g, U\^g). (57) 

q,x,y 

In order to retain the original form of correlations between Alice and the players in the carrier, the 
operator U must satisfy the following property 

UY^u''^--y^\Q=n\Tj^)6^,y yq, (58) 

q 

for some states \rix)- Putting x = y one finds that \r]x) is independent of x and hence a rearrangement 
shows that 

5]c.«(--^)([/|e,)-|?y))=0. (59) 

<? 

Acting on the left hand side by the inverse Hadamard operation, one finds that U{\£,q) — \r])) = 0, 
which means that all the states ^^ are equal to each other and hence the state 10') cannot be an entan- 
gled state. Therefore Eve cannot entangle herself to the Carrier without being detected. 

Note that we have assumed that Eve is an external agent and all the players have run the protocol as 
they should, i.e. have performed their Hadamard operation on the carrier at the end of each round. In 
principle one can assume that a subgroup of players collaborate with Eve, i.e. perform other operations 
than Hadamard in order to ease undetectable Entanglement of Eve with the carrier For example 
consider a (2, 3) scheme with players Bi, B2 and B3. The question is whether one of the players, say 
El is capable to collaborate with Eve to retrieve the secret symbol si To be honest, we have not been 
able neither to devise a successful attack of this type nor a method for its prevention. 

7.3 The role of players collaborations 

It is part of the protocol that all the players should perform their CNOT's on the state \(f)s) in order to 
download the state |s), but once this state is downloaded, then no less than k players can collaborate to 
retrieve the symbol s as proved in ifTSl. One may then argue that this is not a genuine (fc, n) threshold 
scheme, since for downloading the state |s) from the carrier, all the players should collaborate. 

The important point is that the CNOT operation of all the players are needed only for cleaning 
of the carrier from remnants of messages, and in fact any k players can retrieve the symbol s from 
the state that they download from the carrier, but the running of the protocol for other rounds, needs 
collaboration of all the players. 

This assertion can be proved as follows: Let K be any set of k members who want to retrieve the 
message. Denote by Ck the joint CNOT operations of the k players belonging to the set K, i.e. 

CK:=(g)CB^,j (60) 
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Denote also by Cn-k the joint CNOT operations of the rest of N — k players. Also denote by A^k, 
the local operation and classical communications that the k players perform among themselves to 
recover the symbol s from |s). We have shown that the sequence of operations AIkCkCn-k when 
acting on the state |0s) in ( |48] | produces the symbol s unambiguously and leaves the carrier clean of 
the remnants of the message, i.e. disentangle the state \s) from the carrier It is important to note that 
due to their local nature the two operations A^k and Cn-k commute, so that we have the identity 

A^kCkCn-k = C^-kMkCk = Cn-k (MkCk) ■ (61) 

However if the operation on the left hand side of this relation, leaves the k players in the set K with an 
unambiguous symbol s, we can conclude that the operations (A^kCk) does the same thing, because 
the remaining operation Cn-k, by its local nature, has no effect on the qudits retrieved by the set K. 
The sole effect of Cn-k is to disentangle completely the carrier from the message state and make it 
ready for the next round. Such collaboration is of course necessary for the continuous running of the 
protocol like any other communication task. Let us now study a simple example, in which we will 
also see in explicit terms the above argument. 

8 Example: The (2, 3) Threshold Scheme 

The simplest threshold scheme is the scheme (2, 3) for which 

Pc,s{x) ^ co + sx (62) 



and hence 



■i=^\co,co + s,cn + 2s,] 



V3 



Co 



(/0X0X2)«i=^|co,co,co) (63) 



V3 



Co 



or more explicitly as 



0^|0) = -^(|000) + |111) + |222)) 

l^|l> = i(|012) + |120) + |201)) (64) 

2^|2) = i=(|021) + |102) + |210)). 

Note that for qudits, the operators X and Z (to be used later) are defined as X\i) = \i + 1, modd) 
and Z\i) = w*|i), where w'^ = 1. Equation (|63] l shows what kind of encoding circuit Alice has to use 
to encode a state J2s '^s\s) to J2s "^sls). The encoding circuit is shown in figure (HJ. Moreover it is 
easily seen from (l64l i that the operator Z defined as 

Z ■.^{I(g)Z(^ Z^) (65) 

acts as follows on the code states 

Z\s)=uj~'\s). (66) 

These encoded states have the nice properties that 

Z-^®Z2\s) ^LJ'\S), 

Z^^®Z^\s) =c^1s), (67) 

Z^^®Zi\s) =uj'\s), 
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Figure 1 : (Color Online) The encoding circuit used by Alice, for generating the (2,3) code | s) from s. 
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Figure 2: (Color Online) The schematic form of the carrier (thick line) and the uploading (by A) and 
downloading (by Bi , B2 and B^) for a simple (2, 3) threshold scheme. 



which shows clearly that any two of the receivers can retrieve the classical secret s by local measure- 
ments of the encoded state. The uploading and downloading operators for this scheme are shown in 
figure ^. 



Let us now see explicitly in this example, an instance of the general discussion after equation ( 
In other words, we want to show that although the CNOT action of all three receivers is necessary for 
disentangling the state \s) from the carrier, it does not mean that full collaboration of the participants 
is necessary for recovering the message s. That is let us show that even without the collaboration of 
Sa, Bi and B2 can indeed disentangle and retrieve the message from the carrier. The collaboration of 
i^a is only needed to clean the carrier from the message. 

Assume that only two of the participants, say Bi and B2 enact their CNOT's on the state \(t)s)- 
The resulting state will be 



Ci3iCsJ(/>^) 



-7^ X! I*)--! I-^'-?' + *'■?' + 2*>BiB2B3 |fc, fc + s, fc + J + 2(i + S))l23. 



Thus measurements of qudits 1 and 2 by these two participants reveals the secret s, without any need 
for collaboration of ^3 . 

On the other hand suppose that the player ^3 wants to retrieve the message symbols on his own. 
To this end he adds to the quantum carrier 10)^^ ^ ^ ^^ extra qudit, in the state |^o) , and at the 
end of each round, when all the parties are supposed to act on the carrier by Hadamard operators, 
B^ acts by a suitable bi-local operator on his two qudits, so that in conjunction with the Hadamard 
operators of A, Bi and B2, the quantum carrier transforms to 
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W) = E !*'■?■ + *' J' + 2*, j),,,^,,^,,3 |r?,)^, (68) 

This is the only operation he can do in order not to destroy the correlations between stray qudits 
which is checked randomly by Alice and the participants. 

Now when the other participants proceed as usual for entangling a code state \s) to and from the 
quantum carrier, B^ wants to proceed in a different way to reveal the symbol s on his own. The state 
of the quantum carrier and the code state |s), which at the beginning of a round is |0') |s), after Alice 
CNOT operations will develop as follows: 

I'/'l) =El*>Ji + ':.?+ 2i, J, r?,)^^^^^^^,|m)i,2,3 (69) 

where we use the subscripts 1, 2, 3 to denote the qudits which are respectively sent to Bi, B2 and B^. 
It is now easily verified that the density matrix of the qudits ^3 , Sg , 1 , 2 and 3 is given by 

which is independent of s. Therefore even when one of the participants entangles a qudit to the quan- 
tum carrier, refrains from cooperation with others in applying Hadamard gates and/or inverse CNOT 
operations, he cannot obtain any information about the secret symbol s. 

The collaboration of all the participants, is only necessary for disentangling completely the data 
from the carrier and making it ready for next use. This is certainly a feature that any communication 
protocol should have. 

9 Discussion 

We have developed the concept of quantum carrier lfT4l l8l to encompass more complex classical secret 
and quantum sharing schemes. We have described the procedure of uploading and downloading mes- 
sages to and from the carrier in increasingly complex situations, i.e. for quantum key distributions, for 
(2, 2), {n, n) and (fc, n) threshold schemes. As described in the text, for each task a different quantum 
carrier is required, although it seems that they all have similar forms ( [38] l. We have also shown that 
simple intercept-resend attacks can destroy the pattern of entanglement in the carrier which can be 
detected by legitimate parties. In the general (fc,n) secret sharing scheme, although collaboration 
of all parties is required for the continuous running of the protocol (i.e. cleaning of the carrier from 
the remnants of the transmitted messages), any set of k players can download and retrieve the message. 

We hope that together with the previous results, the concept of quantum carrier can attract the 
attention of other researchers who will develop it into more complex forms. An important question 
is whether there can be universal carriers between a set of players, which can be used for various 
cryptographic tasks on demand of the players, i.e. quantum key distribution between the sender and 
a particular receiver, or secret sharing between the sender and a particular set of players.? Another 
interesting general question is whether there exist general carriers which can be used to simultaneously 
send many messages to different receivers via a single quantum carrier, in the same way that frequency 
modulation is used for such a goal in classical communication. Finally the question of general proof 
of security of these types of carrier-based protocols remain to be investigated. 
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11 Appendix 

In this appendix we want to prove that the vectors in (l30l l satisfy the properties ( |33] ). That is if we 
define 

(eO,=/, J = 0, l,---n-l, Z = 0, l,---fc-l, (71) 

then 

e.; ■ ej = 0, 1 < i,j < fc — 2, 

e • e^ = 0, 0<j<k-2, (72) 

e • e = —1. 

Let p be an odd prime and define 

p-i 

Sk{p):=Y.j''. (73) 

First we prove that. 

Skip) = ~Sk,p-i, mod p. (74) 

Consider the following identity: 

p-i 

Expand the first term by using the binomial theorem to find 



p-i 



E 



rn — 1 

m 



(76) 



Interchange the order of the two summations and use the definition ( |73] l to obtain 

ni — 2/ \ 

E ( 7 ) ^'■(^) + ^^S„,-i{p) = 0. (77) 



This gives us a recursion relation in the form 






5,„_i(p) = _ ^ '^ Srip). (78) 

The recursion relation is valid for 2 < m < p. The lower bound is obvious from the upper limit on 
the summation. The upper bound is due to the fact that for m = p, the denominator itself vanishes 
modulo p. Equation dTSl) leads for example to 
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S2{P) = 


1 
"3 


T Siiv) 

A 1 / 






Sz{p) = 


1 
^4 


r/ 4 \ / 4 \ 1 

^ 5i(p)+ 5 52b) 

A 1 / V ^ / 




Sa{p) = 


1 
"5 


{ ] ) S^ip) 
A 1 / 


V ^ / 


/ 5 \ 1 
V -^ / 



(79) 



Direct calculation gives Si{p) — 1 + 2 + 3 + • • • (p — 1) — ^^^~ ' which is zero mod p, since p — 1 is 
even. The recursion relations above then imply that Sm (p) = for all 1 < to < p. The case m — p 
should be calculated directly, using the Euler theorem which states that for every prime number p, 
jp-i _ ^ mod p. The result is immediate, namely Sp-i{p) = — 1. 

Now using the relation ( l74b it's easy to verify that the vectors e^ in ( fTTI ) satisfy the desired prop- 
erties in ( |72] |. 
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